Yeah I've been happy with setting DHCP to internally resolve subdomains to local ip addresses, combined with a lets encrypt wildcard cert created with a DNS cha

Yeah I've been happy with setting DHCP to internally resolve subdomains to local ip addresses, combined with a lets encrypt wildcard cert created with a DNS challenge. Everything secured behind WireGuard and you never for a second need to make your web services public.